Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.   PLEASE REVIEW IT CAREFULLY

We respect the privacy of your protected health information and are committed to maintaining our residents' confidentiality. This Notice applies to all information and records related to your care that our facility has received or created. It extends to information received or created by our employees, staff, volunteers and the Medical Director or employed physicians.  This Notice informs you about the possible uses and disclosures of your protected health information. It also describes your rights and our obligations regarding your protected health information.

We are required by law to:

• maintain the privacy of your protected health information;

• provide to you this detailed Notice of our legal duties and privacy practices relating to your protected health information; and

• abide by the terms of the Notice that are currently in effect.

1. WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION FOR TREATMENT, PAYMENT, AND HEALTH CARE OPERATIONS WITHOUT NEEDING TO OBTAIN YOUR CONSENT

We may use and disclose your protected health information for purposes of treatment, payment and health care operations. We have described these uses and disclosures below and provide examples of the types of uses and disclosures we may make in each of these categories.   For each category of uses or disclosures we will explain what we mean regarding the types of uses and disclosures we may make in each of these categories. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

For Treatment. We will use and disclose your protected health information in providing you with treatment and services. We may disclose your protected health information to facility and non-facility personnel who may be involved in your care, such as physicians, nurses, nurse aides, and physical therapists. For example, a nurse caring for you will report any change in your condition to your physician. We also may disclose protected health information to individuals who will be involved in your care after you leave the facility.

For Payment. We may use and disclose your protected health information so that we can bill and receive payment for the treatment and services you receive at the facility. For billing and payment purposes, we may disclose your protected health information to your representative, an insurance or managed care company, Medicare, Medicaid or another third party payor. For example, we may contact Medicare or your health plan to confirm your coverage or to request prior approval for a proposed treatment or service.

For Health Care Operations. We may use and disclose your protected health information for facility operations. These uses and disclosures are necessary to manage the facility and to monitor our quality of care. For example, we may use protected health information to evaluate our facility's services, including the performance of our staff in caring for you. We may disclose your protected health information to accrediting organizations and/or firms that audit our services for compliance. We may also combine information about residents to evaluate effectiveness of new or current treatment methods.

• WE MAY USE AND DISCLOSE PROTECTED HEALTH INFORMATION ABOUT YOU FOR OTHER SPECIFIC  PURPOSES

Facility Directory. Unless you object, we will include certain limited information about you in our facility directory. This information may include your name, your location in the facility, and your religious affiliation. Our directory does not include specific medical information about you. We may release information in our directory, except for your religious affiliation, to people who ask for you by name. We may provide the directory information, including your religious affiliation, to any member of the clergy.  Individuals Involved in Your Care or Payment for Your Care. We may disclose your protected health information to a family member or close personal friend, including clergy, who is involved in your care, if the personal health information is relevant to that person’s involvement. We may also give information to someone who helps pay for your care.

Disaster Relief. We may disclose your protected health information to an organization assisting in a disaster relief effort.

As Required By Law. We will disclose your protected health information when required by law to do so.

Public Health Activities. We may disclose your protected health information for public health activities. These activities may include, for example

• reporting to a public health or other government authority for preventing  or controlling disease, injury or disability, or reporting child/elder abuse or neglect;

• reporting to the federal Food and Drug Administration (FDA) concerning adverse events or problems with products for tracking products in certain  circumstances, to enable product recalls or to comply with other FDA requirements;

•  to notify a person who may have been exposed to a communicable disease  or may otherwise be at risk of contracting or spreading a disease or condition or for certain purposes involving workplace illness or injuries.

Reporting Victims of Abuse. Neglect or Domestic Violence. If we believe that you have been a victim       of abuse, neglect or domestic violence, we may use and disclose your protected health information to notify a government authority if required or authorized by law, or if you agree to the report.

Health Oversight Activities. We may disclose your protected health information to a health oversight agency for oversight activities authorized by law. These may include, for example, audits, investigations, inspections and licensure actions or other legal proceedings. These activities are necessary for government oversight of the health care system, government payment or regulatory programs, and compliance with civil rights laws.

Judicial and Administrative Proceedings. We may disclose your protected health information in response to a court or administrative order. We also may disclose information in response to a subpoena, discovery request, or other lawful process; efforts will be made to contact you about the request or to give you an opportunity to obtain an order or agreement protecting the information.

Law Enforcement. We may disclose your protected health information for certain law enforcement purposes, including as required by law to comply with reporting requirements; to  comply with a court order, warrant, subpoena, summons, investigative demand or similar legal  process; to identify or locate a suspect, fugitive, material witness, or missing person; when  information is requested about the victim of a crime if the individual agrees or under other  limited circumstances; to report information about a suspicious death; to provide information  about criminal conduct occurring at the facility; to report information in emergency  circumstances about a crime; or where necessary to identify or apprehend an individual in  relation to a violent crime or an escape from lawful custody.

Coroners, Medical Examiners, Funeral Directors, Organ Procurement Organizations. We may release your protected health information to a coroner, medical examiner, funeral director or, if you are an organ donor, to an organization involved in the donation of organs and tissue.

To Avert a Serious Threat to Health or Safety. We may use and disclose your protected health information when necessary to prevent a serious threat to your health or safety or the health or safety of the public or another person. However, any disclosure would be made only to someone able to help prevent the threat.

Military and Veterans. If you are a member of the armed forces, we may use and disclose your protected health information as required by military command authorities. We may also use and disclose protected health information about foreign military personnel as required by the appropriate foreign military authority.

Workers' Compensation. We may use or disclose your protected health information to comply with laws relating to workers' compensation or similar programs.

National Security and Intelligence Activities Protective Services for the President and  Others. We may disclose protected health information to authorized federal officials conducting  national security and intelligence activities or as needed to provide protection to the President of the United States, certain other persons or foreign heads of states or to conduct certain special investigations.

Fundraising Activities. Unless you object, we may use certain protected health information to contact you in an effort to raise money for the facility and its operations. We may disclose protected health information to a foundation related to the facility so that the foundation may contact you in raising money for the facility. In doing so, we would only release contact information, such as your name, address and phone number and the dates you received services at the facility. Such fundraising communications shall provide, in a clear and conspicuous manner, the opportunity for you to opt out of receiving future fundraising communications.

Appointment Reminders. We may use or disclose protected health information to remind you about appointments.

Treatment Alternatives. We may use or disclose protected health information to inform you about treatment alternatives that may be of interest to you.

Health Related Benefits and Services. We may use or disclose protected health information to inform you about health-related benefits and services that may be of interest to you.

Marketing Communications Discussions between Reformed Presbyterian Home (RP Home) and you concerning possible products and services offered by outside entities are considered “marketing communications.” For example, if an outside vendor requests that we recommend their product or service to you, or provide you with a pamphlet or other written brochures, a “marketing discussion” has occurred. Generally, speaking, before we can engage in these conversations with you, or provide you with the materials, we will need to receive your authorization. The only current exceptions to this process are for communications made:

1. to provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for you, and so long as any payment received by us from the  outside supplier in exchange for making this communication is reasonably related to our cost of making the communication; or
2. for the following treatment and health care operations purposes, except where we  receive payment in exchange for making the communication (i) For treatment of an individual by a health care provider, including case management or care coordination for  the individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the individual;(ii) To describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication, including communications about: the entities participating in a health care provider network or health plan network;  replacement of, or enhancements to, a health plan; and health-related products or services  available only to a health plan enrollee that add value to, but are not part of, a plan of  benefits; or (iii) For case management or care coordination, contacting of individuals  with information about treatment alternatives, and related functions to the extent these  activities do not fall within the definition of treatment.

Psychotherapy Notes, Drug/Alcohol Treatment Information, HIV-related information.  Notes recorded by a mental health care professional documenting or analyzing the contents of  conversation during a private counseling session or a group, joint or family counseling session  that are maintained separately from your medical record are afforded additional protections  under federal law. Psychotherapy notes may only be released in more limited situations than those described above with respect to mental health records or otherwise, with your authorization. Drug and alcohol treatment information may only be released with your authorization or pursuant to a Court Order in limited circumstances. Finally, HIV-related information such as information pertaining to HIV testing or your HIV status, may only be released in limited situations under state law.

•  YOUR AUTHORIZATION IS REQUIRED FOR ALL OTHER USES OF PROTECTED HEALTH INFORMATION

We will only use and disclose personal health information (other than as described in this Notice or required by law) with your written Authorization. You may revoke your Authorization to use or disclose protected health information in writing, at any time. If you revoke your Authorization, we will no longer use or disclose your protected health information for the purposes covered by the Authorization, except where we have already relied on the Authorization.

4. YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION

You have the following rights regarding your protected health information at the facility:

Right to Request Restrictions. You have the right to request restrictions on our use or disclosure of your protected health information for treatment, payment or health care operations. You also have the right to restrict the protected health information we disclose about you to a family member, friend or other person who is involved in your care or the payment for your care. We are not required to agree to your requested restriction, unless you have requested us to restrict disclosures to a health plan for purposes of carrying out payment or health care operations and the information to be restricted pertains solely to a health care item or service for which you (or person, other than the health plan on behalf of you) have paid us in full. However, if we do agree to the restriction, then we must adhere to the restriction.

Right of Access to Protected Health Information. You have the right to request, either orally or in writing, your medical or billing records or other written information that may be used to make decisions about your care. If we maintain your information in an electronic record, you may obtain from us a copy of such information in an electronic format and direct us to transmit such copy directly to an entity or person designated by you. We must allow you to inspect your records within 24 hours (excluding weekends or holidays) of your request. If you request copies of the records, we must provide you with copies within 2 days (excluding weekends or holidays) of that request in whatever format you choose, provided that the records are “readily producible” in the requested form. We may charge a reasonable fee for our costs in copying and mailing your requested information.

Right to Request Amendment. You have the right to request the facility to amend any protected health information maintained by the facility for as long as the information is kept by or for the facility. You must make your request in writing and must state the reason for the requested amendment. We may deny your request for amendment if the information:

• was not created by the facility, unless the originator of the information is no longer available to act on our request;
• is not part of the protected health information maintained by or for the facility;  is not part of the information to which you have a right of access; or

• is already accurate and complete, as determined by the facility.

If we deny your request for amendment, we will give you a written denial including the reasons for the denial and the right to submit a written statement disagreeing with the denial.

Right to an Accounting of Disclosures. You have the right to request an "accounting" of our disclosures of your protected health information. This is a listing of certain disclosures of your protected health information made by the facility or by others on our behalf, but generally does not include disclosures for treatment, payment and health care operations, disclosures made pursuant to a signed and dated Authorization, or certain other exceptions. If, however, we implement the use of electronic health records, disclosures for treatment, payment and health care operations purposes will be included in an accounting requested by you. To request an accounting of disclosures, you must submit a request in writing, stating a time period beginning on or after April 14, 2003 that is within six years from the date of your request (or within three years if we implement the use of electronic health records). An accounting will include, if requested: the disclosure date; the name of the person or entity that received the information and address, if known; a brief description of the information disclosed; a brief statement of the purpose of the disclosure or a copy of the authorization or request; or certain summary information concerning multiple similar disclosures. The first accounting provided within a 12

month period will be free; for further requests, we may charge you our costs.

Right to a Paper Copy of This Notice. You have the right to obtain a paper copy of this Notice, even if you have agreed to receive this Notice electronically. You may request a copy of this Notice at any time.

Right to Request Confidential Communications. You have the right to request that we communicate with you concerning personal health matters in a certain manner or at a certain location. For example, you can request that we contact you only at a certain phone number. We will accommodate your reasonable requests.

Prohibition on the Sale of PHI. We and our business associates are prohibited from receiving direct or indirect payments in exchange for an individual’s PHI unless we have obtained a valid authorization in accordance with Section III above. When used for this purpose, the authorization must state whether the PHI can be further exchanged by the entity receiving the information. However, this prohibition does not apply to exchanges of information for purposes of research or public health activities, health care operations or business associate activities related to the care or treatment of the individual, or the sale/merger of the covered entity with  another entity, or other exceptions permitted by law.

•  DUTY TO NOTIFY YOU OF BREACH

Duty to Notify. We are required to notify you in the event that your unsecured protected health information (PHI) is breached. A “breach” is defined as the unauthorized acquisition, access, use, or disclosure of PHI which compromises the security or privacy of the PHI, but does not include unintentional acquisition, access or use of such information, inadvertent disclosure of such information within a facility, and disclosure to a person not reasonably able to retain it. “Unsecured protected health information” refers to PHI that is not secured through the use of a  valid encryption process approved by the Secretary of Health and Human Services or the destruction of the media on which the PHI is  recorded or stored. Such encryption or destruction methods are not mandated on covered entities such as ours. We will evaluate the propriety of securing PHI for our residents, and act using our own discretion. However, should any of your “unsecured” PHI held by us be “breached,” then we will notify you in the manner discussed below.

Timing and Method of Notification. We will notify you no later than 60 days after discovery of such breach via first-class mail or e-mail, if specified by you as your preference. If the breach involves the information of more than 500 individuals, we will also provide notice to prominent media outlets. We will also notify the Secretary of Health and Human Services of the breach (immediately if the breach involves the information of more than 500 individuals or in an annual notification for all other breaches).

Contents of Notification. Our notification to you will include:

• A brief description of what happened, including the date of breach and  date of discovery (if known)

• A description of the types of PHI that were involved in the breach

• Any steps you should take to protect yourself from potential harm resulting from the breach

• A brief description of what we are doing to investigate the breach, mitigate harm to the resident, and protect against further breaches; and

• Contact procedures for you to ask questions or learn additional information, which must include a toll-free telephone number, an e-mail address, Web site, or postal address.

6. COMPLAINTS

If you believe that your privacy rights have been violated, you may file a complaint in writing with the facility or with the Office of Civil Rights in the U.S. Department of Health and Human Services. To file a complaint with the facility, contact the Privacy Officer.  We will not retaliate against you if you file a complaint.

7. CHANGES TO THIS NOTICE

We will promptly revise and distribute this Notice whenever there is a material change to the uses or disclosures, your individual rights, our legal duties, or other privacy practices stated in this Notice. We reserve the right to change this Notice and to make the revised or new Notice  provisions effective for all protected health information already received and maintained by the  facility as well as for all protected health information we receive in the future. We will post a copy of the current Notice in the facility near the receptionist desk at the nursing center entrance. In addition, we will provide a copy of the revised Notice to all residents.

8. FOR FURTHER INFORMATION

If you have any questions about this Notice or would like further information concerning your privacy rights, please contact the Privacy Officer.

Revised 7/18/2020